Yes they could. That's what reproducible builds are for. And Linux distribution maintainers. You better install software from places like the Debian package repository (or your distribution's repo) or from F-Droid (if you're using Android).